lov-rename-project
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/rename_project.pyscript invokesgitandghbinaries using thesubprocessmodule to manage repository state and perform project renaming. The utility validates the new project name against a strict alphanumeric regular expression to mitigate command injection risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project files to identify strings for replacement. While it primarily generates reports and performs text substitution, the processing of external project data represents a potential surface for indirect prompt injection if malicious instructions are embedded within the scanned files.\n- [PERSISTENCE]: Thescripts/profile_store.pyscript manages a local profile in the user's home directory to persist preferences. It includes explicit checks to prevent the storage of sensitive fields such as tokens or passwords, adhering to security best practices for local state management.
Audit Metadata